hunt-grpc

Enumerate gRPC services via reflection and test unauthenticated access.

Updated Jun 5, 2026

Search Tags:#security #authentication #vulnerability #reflection #grpc #grpc-web #protos

Ready to run

npx skills add https://github.com/sseshachala/Claude-BugHunter-archive --skill hunt-grpc

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-grpc
Source: https://github.com/sseshachala/Claude-BugHunter-archive/tree/main/skills/hunt-grpc
Command: npx skills add https://github.com/sseshachala/Claude-BugHunter-archive --skill hunt-grpc

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Enumerate and exploit gRPC service exposure to identify misconfigurations, weak auth, and data leakage in microservices.

Core Features & Use Cases

Enumerate services via server reflection to build a full API catalog without source code.
Detect missing authentication on internal gRPC endpoints and test for access bypass.
Identify plaintext gRPC, HTTP/2 rapid reset DoS, and proto file disclosures.
Apply in environments with gRPC running on ports like 443 or 50051 and microservice architectures.

Quick Start

Enumerate gRPC services via reflection and begin unauthenticated testing with grpcurl against the target.

Frequently Asked Questions about hunt-grpc

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I enumerate gRPC services without having the proto files?▼

You can enumerate gRPC services without proto files by using server reflection to build a full API catalog. This allows you to discover available endpoints and methods directly from the target service.

What is the best way to test for unauthenticated access on gRPC endpoints?▼

The best way to test for unauthenticated access on gRPC endpoints is by enumerating services via reflection and then using grpcurl to call methods directly. This identifies missing authentication and internal endpoint exposure.

How does gRPC-Web proxy exposure lead to proto leakage?▼

gRPC-Web proxy exposure leads to proto leakage when misconfigured proxies expose internal service definitions. Testing these scenarios reveals plaintext gRPC communications and disclosed proto file structures.

Can I use this to find gRPC misconfigurations on microservice architectures?▼

Yes, you can use this to find gRPC misconfigurations on microservice architectures. It targets environments exposing gRPC over TLS on ports like 443 or 50051 to detect weak auth and data leakage.

How do I check a gRPC target for HTTP/2 rapid reset DoS considerations?▼

To check a gRPC target for HTTP/2 rapid reset DoS considerations, you test the service's exposure and configuration limits. This structured workflow identifies potential denial of service vectors during endpoint analysis.

Why does gRPC reflection expose internal endpoints?▼

gRPC reflection exposes internal endpoints because it is designed to return service definitions to clients for dynamic method invocation. When left enabled without authentication, attackers can map the entire API surface.